Safety system for an elevator structure

ABSTRACT

Safety system of an elevator installation, with a control unit, a bus node, a safety element and a bus, which enables a communication between the control unit and the bus node. The bus node includes a first switching arrangement, which on digital presetting by the control unit acts on the safety element by a first analog signal. The bus node additionally includes a second switching arrangement which derives an analog signal from the safety element and makes digital feedback information available to the control unit by way of the bus.

BACKGROUND OF THE INVENTION

The present application is the National Phase of InternationalApplication PCT/CH2004/000393, which claims priority from EuropeanApplication 03405483.3 filed Jun. 30, 2003.

The invention relates to a bus-based safety system of an elevatorinstallation and a method for checking the safety system of an elevatorinstallation.

Elevator installations comprise a safety circuit in which several safetyelements, such as, for example safety contacts and safety switches, arearranged in a series connection. The contacts monitor, for example,whether a shaft door or the cage door is open. The elevator cage can bemoved only when the safety circuit and thus all safety contactsintegrated therein are closed. Some of the safety elements are actuatedby the doors. Other safety contacts, such as, for example, anover-travel switch are actuated or triggered by the elevator cage.

The safety circuit is connected with the drive or the brake unit of anelevator installation in order to interrupt the travel operation if thesafety circuit is opened.

Safety systems with safety circuits of this kind are subject to numerousdisadvantages, which are briefly listed in the following on the basis ofa few examples:

-   -   Every safety circuit has inherent problems; belonging to these        are the length of the connections, the voltage drop in the        safety circuit and the comparatively high cost of mounting.    -   The individual safety contacts are relatively susceptible to        disturbance; unnecessary emergency stops of the elevator system        can therefore happen.    -   The safety circuit does not permit a specific diagnosis; i.e.,        when the safety circuit is open it is only established that at        least one safety contact is open.    -   A precautionary maintenance is not possible, since no        indications about the state of the safety contacts of the safety        circuit takes place. It is thus not possible to preventatively        maintain the elevator installation and replace worn safety        contacts in good time at a point when the elevator installation        can be shut down without problems, be it within the scope of a        periodic inspection, wherein, however, in many cases taking the        elevator installation out of operation, which is not in itself        necessary, is carried out.

The availability of the installation can be restricted in an unnecessarymanner, since the detection of an open safety contact always has theconsequence of placing the elevator installation out of operation.

It was therefore proposed to equip elevator installations in the futurewith a safety bus system instead of with the mentioned safety circuit.The safety bus system typically comprises a control unit, a safety busand one or more bus nodes.

A safety system with a safety bus is described in Application EP01810903.3, which was filed on 18 Sep. 2001. The safety bus is used inorder to enable a safe and reliable monitoring of the shaft doors of thelift installation.

In a further patent application EP 01810904.1, which was filed on 18Sep. 2001, there is described a safety system with safety bus whichallows an intelligent evaluation of the state of cage and shaft doors.

A safety system with safety bus comprises, in the case of some of theproposed embodiments, at least one bus node which can, for example, beconnected with a safety element in order to interrogate the statethereof. Thus, information about the instantaneous state of the safetyelements can be provided. In manner similar to conventional elevatorinstallations with a safety circuit, a reaction can be triggereddepending on the respective state of the safety element.

Such safety systems with a safety bus have to be constructed to be safe.Otherwise, for example, undefined states or erroneous interpretationscan happen. In particular, the interrogation of the safety elements ofthe safety system by way of the safety bus must be absolutely safe andreliable.

SUMMARY OF THE INVENTION

The object of the invention is thus to be seen in indicating an improvedsafety system of the kind stated in the introduction, by which thedisadvantages of the state of the art can be avoided or at leastsignificantly reduced.

Pursuant to this object, and others which will become apparenthereafter, one aspect of the present invention resides in a safetysystem for an elevator installation, which safety system includes acontrol unit, at least one bus node, at least one safety element, and abus that enables communication between the control unit and the busnode. The bus node includes first switching means that, upon digitalpresetting of a target magnitude by the control unit, acts on safetyelement with a first analog signal, and second switching means thatdrive an analog signal from the safety element and make digital feedbackinformation available to the control unit by way of the bus.

In another embodiment of the invention the at least one safety elementis one or more of the following safety elements: a door contact; a lockcontact; a buffer contact; a flap contact; a sensor; an actuator; atravel switch; and an emergency stop switch.

Another aspect of the invention resides in a method for continuouschecking of the safety system of an elevator installation wherein thesafety system includes a control unit, at least one bus node, at leastone safety element, and a bus that enables communication between thecontrol unit and the bus node. The method includes the steps oftransmitting digital information by the control unit to the bus node byway of the bus in order to thereby preset a target magnitude, convertingthe digital information by the bus node in order to prepare a firstanalog signal that corresponds with the target magnitude or iscorrelated therewith, applying the first analog signal to, or impressionof the first analog signal on, the safety element, deriving or receivingan analog signal at a safety element by the bus node, processing theanalog signal by the bus node, and preparing digital feedbackinformation by the bus node for the control unit.

The bus node can be constructed in a redundant manner whereby thetransmitting, converting, and applying steps are performed by switchingmeans of the bus node that are different from the switching means thatperform the deriving, processing and preparing steps as mentioned above.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention is described in more detail in the following on the basisof examples of embodiment and with reference to the drawing, in which:

FIG. 1 shows a schematic block circuit diagram of a first safety systemaccording to the invention;

FIG. 2A shows a schematic block circuit diagram of a second safetysystem according to the invention;

FIG. 2B shows details of the second safety system according to theinvention; and

FIG. 3 shows details of a third safety system according to theinvention.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 shows a first safety system 10, which is part of an elevatorinstallation. The safety system 10 comprises a control unit 11, at leastone bus node 13, and a bus 12 in order to enable communication betweenthe control unit 11 and the bus node 13. In FIG. 1 there is indicated asafety element 16 which, for example, interrogates the state of a shaftdoor or cage door or monitors a lock. As safety elements in connectionwith the present invention there are denoted safety-relevant elementssuch as, for example, door contacts, lock contacts, buffer contacts,flap contacts, sensors, actuators, travel switches (for example on theinspection panel or in the feedback control) and emergency stopswitches. The bus node 13 comprises a first switching means 14 andsecond switching means 15.

According to the invention the control unit 11 presets for the bus node13 a target magnitude, for example a current strength or a voltage. Thecontrol unit 11 thus acts as a “command transmitter”. The presetting ofthe target magnitude is carried out by transmission of a digital commandor digital information by way of the bus 12 to the bus node 13. A firstanalog signal corresponding with the preset target magnitude is providedby the first switching means 14. The safety element 16 is acted on bythis first analog signal, as indicated by the arrow 16.1. The secondswitching means 15 are so arranged and designed that they derive asecond analog signal from the safety element 16, as indicated by thearrow 16.2. The bus node 13 processes the second analog signal and makesavailable digital feedback information, which is either transmitted byway of the bus 12 to the control unit 11 or is picked up by the controlunit 11 by way of the bus 12 at the bus node 13. In addition, the busnode 13 can make digital diagnostic information available.

The following interrogation pattern in accordance with the invention canthus be implemented:

-   -   1. The control unit presets a target magnitude which is        transmitted as digital information or as a digital command by        way of the bus 12 to the bus node 13;    -   2. The first switching means 14 converts the information and        provides a first analog signal of the corresponding magnitude;    -   3. The first analog signal is applied to the safety element 16        or imposed in the safety element 16;    -   4. The second switching means 15 picks up a second analog        signal, which is correlated with the first analog signal, or is        produced by the first analog signal;    -   5. The second analog signal is prepared by the bus node 13 in        order to enable a qualitative and/or quantitative comparison        with the first analog signal; and    -   6. The bus node 13 makes digital feedback information available        to the control unit 11. In addition, the bus node 13 can make        digital diagnostic information available.

The comparison preferably takes place in the control unit 11 in order tobe able to make a reliable and safe statement about the safety element16. The control unit 11 can thus establish, for example, whether thesafety element 16 is open or closed.

The bus node 13 comprises a first switching means 14 and secondswitching means 15. It is also possible in the case of preparation ofthe analog signal to undertake a qualitative evaluation of the firstanalog signal, wherein the evaluation is not safety-relevant and cantherefore be carried out entirely or partly by the bus node 13. Thisqualitative evaluation allows a diagnosis about the qualitative state ofthe safety element (for example, the wear and/or the functionalcapability of a contact can thus be assessed). It is particularlyadvantageous to carry out this diagnosis in the bus node 13 in order tominimize data traffic on the bus 12 and thus not load thesafety-relevant control unit 11. The result of the diagnosis is providedas digital diagnostic information.

Depending on the respective form of embodiment and implementation of theinvention a statement can be made about the switching state of thesafety elements 16, as also about the function of the entireinterrogation chain. By interrogation chain there is to be understood,in the present connection, the chain of the control unit, via the bus,the bus node, the safety element and the bus back to the control unit.

If, for example, the control unit 11 presets a specific current astarget magnitude, which is then imposed in the safety element 16, thecontrol unit 16 can thus establish by way of the second switching means15 and by means of the feedback information whether the correspondingcurrent or, for example, voltage, which is correlated with the current,or is measured.

In the case of a quantitative comparison of the analog signals there isascertained by the control unit 11 whether, for example, the signal S₁corresponds with the signal S*₁ (see FIG. 2B). In that case translationfactors can be taken into consideration or a value pair can be extractedfrom a table. For clarification, a simple numerical example is given.The control unit 11 presets a current of 1 A. The switching means 14provides a current with a current strength of 1 A. This current flowsthrough the safety element 16. On the evaluation side, a voltage of 5Vis measured by the switching means 15, wherein the switching means hasthe resistance of 5 Ohms, in order to convert the current into avoltage. It can be inferred from a table, which, for example, is filedin a memory of the bus node 13, that a voltage of 5V corresponds with acurrent of 1 A. In this case the comparison of the value pair (1 A; 5V)has given the result that the interrogation chain functions.

The qualitative comparison (also termed diagnosis) is preferably sodesigned that a certain tolerance is taken into consideration. In orderto return to the numerical example, the interrogation chain wasevaluated as functioning as long as the voltage deviated from thevoltage 5V by, for example, less than 0.5 Volts. It can thus be takeninto account that certain inaccuracies and losses are inherent in suchan interrogation chain.

The tolerance or tolerances can be absolute or relative. The tolerancescan also be variable.

If the voltage value ascertained by the switching means 15 lies outsidethe tolerance range, then a reaction can be initiated. This takes place,for example, by the control unit 11. In the case of a small deviation aservice call can be triggered by the control unit 11. In the case of agreater deviation this has to be interpreted as “faulty function” andlead to, for example, an emergency stop of the elevator installation.

FIGS. 2A and 2B show a second safety system 20, which is part of anelevator installation. The safety system 20 comprises a control unit 21,at least one bus node 23, and a bus 22 in order to enable acommunication between the control unit 21 and the bus node 23. In FIG.2A and FIG. 2B there is shown a switch 26 as a safety element, which,for example, interrogates the state of a shaft door or cage door ormonitors a (shaft door) lock. The bus node comprises first switchingmeans 24 and second switching means 25.

The first switching means 24 comprise, in the illustrated form ofembodiment, a processor 24.1 which can receive digital information byway of the bus 22, as indicated by the arrow 22.1. There is provided awrite element 24.2 which provides a “control” signal S_(S) which isapplied to a regulable current source 24.3 and there causes productionof a current. For this purpose the write element 24.2 can comprise, forexample, a digital-to-analog converter. A processor 24.1 evaluates thedigital information in order to ascertain which target magnitude thecontrol unit 21 has preset and makes available to the write element 24.2a digital signal D_(Soll). The current is here termed first signal S₁.This first signal S₁ is correlated with the “control” signal S_(S). Whenthe switch 26 is closed the current S₁ flows by way of the connection26.1 into the switch 26 and a current S*₁ flows by way of the connection26.2 into the switching means 25.3. In the case of an ideal switch 26the current S₁ is thus equal to the current S*₁, i.e. there are nolosses in the switch 26. The switching means 25.3 is, in the presentexample, a converter which converts the current S*₁, which is suppliedby way of the line 26.2, into a voltage S₂. The voltage S₂ is heretermed second signal S₂. The converter 25.3 can comprise, for example, aresistance divider and a filter. The converter 25.3 is followed by aread element 25.2 which processes the second signal S₂. The read element25.2 converts the second signal S₂ into a digital magnitude D_(lst)which is fed to a processor 25.1. For this purpose the read element 25.2can comprise, for example, an analog-to-digital converter.

The second form of embodiment is so designed that the bus node 23carries out a diagnosis by a qualitative comparison of the first analogsignal S₁ with the second analog signal S₂. This comparison can beformed by, for example, the processor 25.1, the processor 24.1 or bothprocessors 24.1 and 25.1 together. A comparison operation by only one ofthe processors 24.1 and 25.1 requires at least one cross-connectionbetween the first switching means 24 and the second switching means 25.The result of the comparison is subsequently made available to thecontrol unit 21 as digital diagnostic information. The digitaldiagnostic information can either be called up from the control unit 21at the bus node 23 (pull principle) or the bus node 23 can transmit thedigital diagnostic information by way of the connection 22.2 and the bus22 to the control unit 21 (push principle). The described qualitativecomparison is carried out additionally to the quantitative comparisonwhich is performed in the control unit 21 on the basis of digitalfeedback information.

A performance of the qualitative comparison in the bus node 23 has theadvantage that the bus 22 is not loaded by the transmission of signals,but in each instance only the digital diagnostic information which inprinciple represents the result of the qualitative comparison and thefeedback information for the quantitative comparison to be carried outin the control unit is transmitted by way of the bus 22 to the controlunit 21.

The afore-described forms of embodiment allow a reliable statement aboutthe function of the entire interrogation chain, inclusive of the safetyelement.

A further form of embodiment of the invention is so designed that notonly a comparison of the analog signals, but also an evaluation of thesecond analog signal S₂ is undertaken. Depending on the respectiveaccuracy of the converter 25.3 and the resolution of the read element25.2, which is primarily determined by the resolution of theanalog-to-digital converter, there can be carried out, apart from a puresafety check of the entire interrogation chain, also an evaluation. Thusan evaluation (in the sense of a diagnosis) of the contact state ispossible if the safety element is a switch, in that the contactresistance is ascertained. In addition, or alternatively, the bouncebehaviour of a switch can be evaluated. The resolution has to besufficient for this purpose, since the bounce behaviour typically fallsat short voltage peaks and a change in bounce behaviour can be recordedonly if a precise evaluation of the voltage peaks takes place.

A further form of embodiment of the invention is illustrated in FIG. 3.In this figure there is shown a bus node 33 which interrogates a safetyelement 36 with two redundant switches 36.1 and 36.2. The firstswitching means 34 comprises, in the illustrated form of embodiment, aprocessor 34.1 which can receive information by way of a connection32.1. A write element 34.2 is provided, which provides “control” signalsS_(S) which are applied to two regulable current sources 34.3 and 34.4.The current source 34.3 provides a current which is here termed firstsignal S₁. The current source 34.4 provides a current which is here alsotermed first signal S₃. The write element 34.2 can comprise, forexample, a digital-to-analog converter which on receiving a digitaltarget magnitude D_(Soll) issues a “control” signal S_(S) correlatedtherewith. The first analog signals S₁ and S₃ are, in turn, with the“control” signal S_(S). If the switch 36.1 is closed, the current S₁flows through the switch 36.1 and as current S*₁ in a switching means35.3. If the switch 36.2 is closed, the current S₃ flows through theswitch 36.2 and as current S*₃ in a switching means 35.4.

The switching means 35.3 and 35.4 are, in the present example,converters which convert the currents S*₁ and S*₃ into voltages S₂ andS₄. The voltages S₂ and S₄ are here termed second analog signals S₂ andS₄. The converters 35.3 and 35.4 can comprise, for example, resistancedividers and filters. The converters 35.3 and 35.4 are followed by aread element 35.2 which processes the second analog signals S₂ and S₄.The read element 35.3 converts the second analog signals S₂ and S₄ intodigital magnitudes D_(lst), which are fed to a processor 35.1 whichtransmits the corresponding digital feedback information by way of theconnection 32.2 to the control unit. The read element 35.2 can comprise,for example, one or two analog-to-digital converters. If only oneanalog-to-digital converter is present, the signals S₂ and S₄ areconverted in succession staggered in time in a multiplex mode.

Through the circuit shown in FIG. 3 the level of safety can also beincreased at the side of the safety element 36, since this isconstructed in redundant manner by the switches 36.1 and 36.2 and can beseparately monitored.

According to the invention the bus node 13 or 23 or 33 is so designedthat it comprises two switching means 14, 15 or 24, 25 or 34, 35. Aredundancy is achieved by this two-channel design.

The safety of the bus node according to the invention can be reduced inthat a bus node is used with only one processor. In this case theprocessor is used not only for controlling the write element, but alsofor processing the digital information of the read element. In that casethe redundancy in part is superfluous, which is prescribed, depending onthe respective field of use, for technical safety reasons. Thefunctionality of the entire system, however, remains substantiallyintact. Costs can be lowered by reduction in the redundancy. However,the safety of the entire system can nevertheless be guaranteed by othermeasures. For example, such a bus node with reduced redundancy can be acomponent of a safety system with a safety bus, according to ApplicationEP 01810903.3 mentioned in the introduction.

According to the invention a safety element 36 with redundant switchesor contacts 36.1, 36.2 can be monitored by a bus node 33. A part of theswitching means 34, 35 can be separately constructed, as shown in FIG. 3on the basis of the switching means 34.3 and 34.4 or 35.3 and 35.4.Another part of the switching means 34, 35 can be used for severalswitches or contacts 36.1, 36.2 in common, as shown on the basis of theswitching means 34.1 and 34.2 or 35.1 and 35.2.

Many standards require a redundant construction of sensors and/orswitches. The form of embodiment shown in FIG. 3 is particularlysuitable for fulfilling such standards.

However, it is also possible with the circuit according to FIG. 3 tomonitor two different safety elements. The first element 36.1 can be,for example, a lock contact and the second safety element 36.2 can be abuffer contact completely independent of the lock contact.

According to a further form of embodiment of the invention the controlunit is designed to be two-channel, wherein a first channel undertakesthe digital presetting of a signal magnitude (target magnitude) and asecond channel receives the digital feedback information from the busnode.

A further form of embodiment of the invention is distinguished by thefact that the switching means 14, 24, 34 produce pulsed first analogsignals.

According to the invention the bus node 13, 23, 33 can comprise furtherelements. There can be provided, for example, interface circuits whichmanage the communication by way of the bus 12, 22 with the control unit11, 21. Preferably here, too, two-channel is used, i.e. a respectiveinterface circuit is provided for the receiver side (switching means 14,24, 34) and a respective interface circuit is provided for thetransmitter side (switching means 15, 25, 35).

If suitable interfaces are provided and a corresponding communicationslog is employed, different bus nodes can be individually addressed byway of the bus. For this purpose each bus node can have an ownidentification word, for example an own address. The control unit thenpresets together with the target magnitude also the address of thedesired bus node. Only the addressed bus node is thus addressed by thecontrol unit.

According to a further form of embodiment of the invention the firstswitching means 14, 24, 34 and the second switching means 15, 25, 35 areeach realised as an integrated circuit. Each of these integratedcircuits then has an analog part and a digital part.

In a further form of embodiment of the invention a voltage is applied asfirst signal to the safety element instead of a current. A conversion ofthe voltage into a current can then be undertaken by the switching means15, 25, 35 or a voltage can be derived directly from the safety element.

According to a further form of embodiment of the invention the converter25.3 comprises an optoelectronic coupler which converts the signal S*₁into an optical signal. This optical signal is then converted at thereceiver side of the optoelectronic coupler into a voltage and can befurther processed.

According to a further form of embodiment of the invention the controlunit comprises means which allows monitoring of the course over time. Iftoo large a time interval passes between the presetting of a targetmagnitude and the reception of a feedback, then this can also be anindication of a fault or a problem in the safety system.

A further form of embodiment of the invention is characterised in thatthe bus node comprises further switching means which allow connectionwith other elements, for example sensors, actuators or displays. In thiscase the bus node can be regarded as a hybrid circuit which monitors notonly safety elements, but also elements not relevant to safety.

The safety system according to the invention is preferably soconstructed that it serves the purpose of detecting at least a part ofthe safety-relevant states of an elevator installation separately fromthe actual elevator control and, on occurrence of problems, oftriggering reactions in that the safety system or the control unitdirectly intervenes in the lift elevator control.

1. A safety system for an elevator installation, comprising: a controlunit; at least one bus node; at least one safety element; and a buswhich enables communication between the control unit and the bus node,wherein the bus node comprises first switching means which on digitalpresetting of a target magnitude by the control unit acts on the safetyelement with a first analog signal and second switching means whichderive an analog signal from the safety element and make digitalfeedback information available to the control unit by way of the bus. 2.The safety system according to claim 1, wherein the at least one safetyelement is at least one safety-relevant elements from the groupconsisting of: a door contact, a lock contact, a buffer contact, a flapcontact, a sensor, an actuator, a travel switch, and an emergency stopswitch.
 3. The safety according to claim 1, wherein the first switchingmeans comprises a write element which provides the first analog signal,and the second switching means comprises a read element which processesa second analog signal.
 4. The safety system according to claim 3,wherein the bus node comprises a processor which converts the presettingof the control unit into the first analog signal or triggers aconversion into the first analog signal.
 5. The safety system accordingto claim 3, wherein the bus node comprises a processor which convertsthe second analog signal into the digital feedback information ortriggers a conversion of the second analog signal.
 6. The safety systemaccording to claim 3, wherein the bus node is operative to carry out aqualitative comparison of the first analog signal with the second analogsignal and/or a qualitative evaluation of the first analog signal andmake a result of the comparison available as digital diagnosticinformation.
 7. The safety system according to one of claim 3, whereinthe control unit is operative to carry out a quantitative comparison ofthe first analog signal with the second analog signal, wherein thecomparison takes place based on the digital presetting and the digitalfeedback information.
 8. The safety system according to claim 1, whereinthe switching means at least in part is an analog switching means andthe bus node comprises an analog-to-digital converter that a) convertsthe digital presetting of the control unit into an analog magnitudewhich corresponds with the first analog signal or is correlated with thefirst analog signal, and b) converts the analog signal into digitalinformation.
 9. A method for continuous checking of a safety system ofan elevator installation, wherein the safety system comprises a controlunit, at least one bus node, at least one safety element and a bus,which enables a communication between the control unit and the bus node,the method comprising the steps of: a) transmitting digital informationby the control unit to the bus node by way of the bus in order tothereby preset a target magnitude; b) converting the digital informationby the bus node in order to prepare a first analog signal whichcorresponds with the target magnitude or is correlated therewith; c)applying the first analog signal to, or impressing the first analogsignal on, the safety element; d) deriving or receiving an analog signalat a safety element by the bus node; e) processing the analog signal bythe bus node; and f) preparing digital feedback information by the busnode for the control unit.
 10. The method according to claim 9, furtherincluding processing of digital information and the feedback informationin the control unit, wherein a statement about the safety element ismade possible.
 11. The method according to claim 9, wherein the step ofprocessing of the analog signal includes a qualitative evaluation of thefirst analog signal, wherein the evaluation is carried out entirely orpartly by the bus node.
 12. The method according to one of claim 9,wherein the converting step includes a digital-to-analog conversion bythe bus node in order to convert the digital information into the firstsignal.
 13. The method according to claim 9, wherein the bus node onprocessing of the analog signal carries out an analog-to-digitalconversion in order to convert the analog signal into the digitalfeedback information.
 14. The method according to one of claim 9,wherein the bus node is constructed in redundant manner and steps a) toc) are performed by switching means of the bus node that are differentfrom steps d) and e).